Your Personal Private Cloud

Your digital life.
Under your control.

Run chat, files, photos, passwords, email and other everyday services for yourself and your family on infrastructure you control. Privalon provides the private network, deployment, monitoring, backups and recovery around them.

privalon — deploy
$ ./scripts/deploy.sh full --env home
# Provisioning your private environment...
✓ Private network ready
✓ Matrix deployed
✓ Monitoring active
✓ Encrypted backups configured
✓ Recovery state verified
✓ Your private environment is healthy.

# Restore on a fresh machine:
$ ./scripts/restore.sh \
  --recovery-line 'bp1-a7f9c2e4b6d81053'
✓ Workspace restored from S3 backup.
// the services behind your digital life

Familiar apps. One operating model.

Use proven open-source applications for communication, storage, passwords, photos and collaboration, with one operating model around all of them — private by default, backed up, monitored, and reachable through one gateway.

Communication
Mail
Full email hosting on Stalwart — SMTP, IMAP, spam filtering.
Personal data
Nextcloud
Files, calendar, and collaboration, with S3-backed storage.
Ente Photos
End-to-end encrypted photo and video backup.
Vaultwarden
A private, Bitwarden-compatible password manager.
Creation & work
OnlyOffice
Real-time document editing, integrated directly into Nextcloud.
Forgejo
Self-hosted Git repositories, issues, and CI for your own projects.
+ your next app
New services plug into the same contract — add one from the Apps tab.

Start with one service.

You don’t need to migrate your entire digital life at once. Start with the service that matters most, prove that deployment, backup and recovery work for you, then expand at your own pace.

01
Pick one service
Chat, files, photos or your password vault — whichever you rely on most.
02
Deploy it and prove recovery
Run it for real, confirm backups and restore actually work, not just that it started.
03
Add more at your own pace
Every new service inherits the same private network, backup, and monitoring model.

Self-hosting is easy on day one.
Day 500 is the hard part.

Installing an application takes minutes. Keeping it private, monitored, backed up, recoverable, and understandable months later is the real work. Privalon treats networking, backups, health, and recovery as part of the platform — not a pile of unrelated admin tasks you rebuild for every new service.

// what privalon handles for you

Self-hosting, without giving up operational safety.

Every capability below exists to reduce the gap between “it started once” and “it runs reliably over time.”

[01] OWN
Your Data, Your Infrastructure
Your files, conversations, photos, and application data live on infrastructure you choose and control.
[02] PRIVATE
Private by Default
Applications and management interfaces stay on the private network unless they genuinely need public exposure — and that exposure is always explicit, not incidental.
[03] RECOVER
Backups You Can Recover From
Encrypted backups are part of the operating model, with recovery designed in from the start rather than added after something breaks.
[04] AWARE
Know When Something Is Wrong
Health checks, logs, and alerts help you notice problems before a family member has to tell you something stopped working — Prometheus, Grafana, and Loki underneath.
[05] GROW
Start Small. Add More Later.
Begin with one important service and grow your private environment as your confidence increases — each addition inherits the same operating model automatically.
[06] CONTROL
One Place to Operate It
See applications, devices, health, backups, and important activity in one place, while technical details remain available when you need them.

Know how your digital home is doing.

See service health, backups, devices, and anything that needs attention in one place. Technical details remain available when you want them. Runs on your own workstation only, never exposed to the internet.

localhost:8090
Home Apps Devices Activity System home ▾
All systems healthy last checked 12:04 · refresh
Needs your attention (0) — all clear.
Your apps
forgejoup
mailup
nextcloudup
vaultwardenup
matrixup
ente-photosup
onlyofficeup
Platform
Network11 of 11 online
Backupshealthy
Certificates87 days left
DNSconverged
Infrastructure
Headscale (control plane)ok
Headplane (admin UI)ok
Gateway (Caddy)ok
Prometheusok
Grafanaok
Lokiok
Backrestok
› Technical details (raw platform state)
// recovery

Infrastructure can be replaced.
Your data can’t.

Privalon separates reproducible infrastructure from the state you actually care about. A recovery line rebuilds your environment’s configuration on a fresh machine; each service’s own encrypted backup restores automatically as it redeploys.

“Save one line. Rebuild your environment anywhere.”

./scripts/restore.sh --recovery-line 'bp1-a7f9c2e4b6d81053-9f8e7d6c5b4a3021'

Minimal surface.
Maximum control.

Your applications may run on different machines, but they behave like one private environment. Services stay private by default; public exposure is always explicit, not accidental. Runs on ThreeFold Grid or Hetzner Cloud today, without your digital life depending on a single provider.

PUBLIC
Gateway VM
Reverse proxy (Caddy), TLS termination, public ingress on 80/443, full-tunnel VPN exit node.
CTRL
Headscale Control VM
Private network control plane — device registration, ACL enforcement, DERP relay, WireGuard key distribution. Headplane gives it an admin UI.
PRIVATE
Workload VMs
Applications bind to the private tailnet by default. Monitoring stack is Prometheus, Grafana, Loki, and Alloy.
BACKUP
Dual S3 Backends
Encrypted Restic backups to two independent S3-compatible stores, tracked by Backrest. Scheduled, deduplicated, replicated.
         Internet
            │
   ┌──────────────────┐
   │ Gateway VM       │
   │ Public 80/443    │
   │ Caddy + Exit Node│
   └────────┬─────────┘
         │ Tailscale
  ┌──────┴─────────┐
  │                 │
┌─┴──────────┐ ┌──┴─────────┐
Headscale  │ │ Workload   │
│ Control VM │ │ VMs (private)│
└────────────┘ └─────────────┘
         │
   Your Devices

// providers: ThreeFold Grid · Hetzner Cloud

Family Ready, and where we’re going

The current milestone is Family Ready — moving real personal workloads onto Privalon, starting with Matrix, before expanding further. This is an early technical product, presented honestly at the stage it’s actually at.

SHIPPED
Private Infrastructure Foundation
Private network, gateway, infrastructure provisioning, monitoring, and backup foundations.
SHIPPED
Personal Application Catalog
Matrix, Nextcloud, Vaultwarden, Mail, Ente Photos, OnlyOffice, and Forgejo, each inheriting backup, DNS, TLS, and observability automatically.
IN PROGRESS
Unified People & Devices
Manage family members, access, and devices centrally instead of creating identities independently inside every application.
PLANNED
Safe Updates & Lifecycle
Know what versions are running, review updates, protect state before risky changes, and recover when an update fails.
PLANNED
Personal AI Access
Let your AI assistant access selected personal Privalon data under your own identity and existing application permissions.